CVE - CVE-2023-31134

CVE-ID
CVE-2023-31134	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9 URL:https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9 MISC:https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4 URL:https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4 MISC:https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5 URL:https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5 MISC:https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp URL:https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp MISC:https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767 URL:https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767 MISC:https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f URL:https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20230424	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230424)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)